A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vim | Vim | 8.1.2269 (including) | 9.0.0339 (including) |
| Red Hat Enterprise Linux 9 | RedHat | vim-2:8.2.2637-20.el9_1 | * |
| Red Hat Enterprise Linux 9 | RedHat | vim-2:8.2.2637-20.el9_1 | * |
| Vim | Ubuntu | bionic | * |
| Vim | Ubuntu | esm-infra-legacy/trusty | * |
| Vim | Ubuntu | esm-infra/bionic | * |
| Vim | Ubuntu | esm-infra/focal | * |
| Vim | Ubuntu | esm-infra/xenial | * |
| Vim | Ubuntu | focal | * |
| Vim | Ubuntu | jammy | * |
| Vim | Ubuntu | kinetic | * |
| Vim | Ubuntu | trusty | * |
| Vim | Ubuntu | trusty/esm | * |
| Vim | Ubuntu | upstream | * |
| Vim | Ubuntu | xenial | * |
Potential Mitigations
References
- https://github.com/vim/vim/commit/a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EX6N2DB75A73MQGVW3CS4VTNPAYVM2M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWIJBSQX53P7DHV77KRXJIXA4GH7XHC/
- https://security.gentoo.org/glsa/202305-16
- https://github.com/vim/vim/commit/a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EX6N2DB75A73MQGVW3CS4VTNPAYVM2M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWIJBSQX53P7DHV77KRXJIXA4GH7XHC/
- https://security.gentoo.org/glsa/202305-16